Analysis
-
max time kernel
4031182s -
max time network
131s -
platform
android_x64 -
resource
android-x64-20231215-en -
resource tags
-
submitted
09-01-2024 22:03
General
-
Target
3f029ec0fdfef78efd091a09e71ed01b40b2903b33cb2dfab058bd304260dde1.apk
-
Size
3.3MB
-
MD5
33fcb8f3dd910618cd8ac775144ad9d0
-
SHA1
8d631703a738b0b8b3800edea66c1db9f423a308
-
SHA256
3f029ec0fdfef78efd091a09e71ed01b40b2903b33cb2dfab058bd304260dde1
-
SHA512
ff1d6cff175ea2306de90f0c162b8ec12e983e44ac056725461044dbd86a1a7123e435fd772e90e04139839fb53868d630a3c71260beb51fde1cc7773ace109f
-
SSDEEP
98304:k+dM2912PhlGN34mxhi8+NVLpyTTooGnrhAQ4bav3ljZCMqvhf:k+dM2/2PhKh+NVL0UprFljZCfvhf
Malware Config
Extracted
alienbot
http://desturswmew.asia
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus payload 1 IoCs
-
Makes use of the framework's Accessibility service 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 8 IoCs
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
Processes
-
gift.dizzy.brush1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
647KB
MD5b635a9a9564110c3ffd24e413a929f0c
SHA170100b56621b70a178aae80ec4fa94402d5a8aa0
SHA256ab1228ec70fc2d0d273af8c7b839268a09c6729167c11764edf1989c15b84a3f
SHA51231dd1f1203db31468b2013282840120e64756f173311270ee189f806a68f351e698cb38b8ff7bf3418bd3aba8c67688ca6663e5e99dd47570a3e636a9bcb1383
-
Filesize
647KB
MD58afc832f6c7fb2d2f8a36ad32e8c0901
SHA173227fadf0f130b83f38812ab5e0166f0597b748
SHA256c38a8807eab562967558c6f2e431a63a8f44347c66e847f675d59e319eb636d4
SHA5128fb59dd0535b3503534fc1ea1d01bbf4a05765acc34e5b89cdd15ddcf848be057a735db5a854c5fa9acc2cf1756015881ffafbb01b722308a492c262b594a620
-
Filesize
451B
MD5dda3ac4a480efb87c13389acd477fb1d
SHA13cd114969a441e19198cc96b78472155989ae086
SHA256d217adff915bf4a0e5f728596a3790c9af27ae250c79a0ab96ff279f16430952
SHA512c573c4df15d61d7ef40d23ee1ea899ce6a344e22c9182e1a53e6edb7b71ccb8060db04ea9765556ad17c6a4b100532c7dac37e6d21e50aa9220aefb75c4d46d5